@opengeni/worker-bundle 1.0.2 → 1.2.0

package/dist/{activities-turn-5LGZOSVU.js → activities-turn-BMY3CDKL.js}

@@ -99,7 +99,7 @@ import {
   withFirstPartyTools,
   wrapLazyTurnBoxWithRouting,
   wrapTurnBoxWithRouting
-} from "./chunk-LJX7Z2KP.js";
+} from "./chunk-JKMG5ZHH.js";
 import {
   StreamTimingMetrics,
   makeMachineOpObserver,
@@ -132,7 +132,7 @@ import {
   runtimeMetricsHooksForObservability,
   sandboxAutomaticRecoveryOutcome,
   turnLifecycleMetricsFor
-} from "./chunk-3ZTRWDMN.js";
+} from "./chunk-XONQEVAD.js";
 import {
   __export
 } from "./chunk-PZ5AY32C.js";
@@ -163,7 +163,7 @@ import {
 } from "@opengeni/db";
 import {
   sandboxOperationMetricObserver as sandboxOperationMetricObserver2,
-  turnExecutionTelemetryKey as turnExecutionTelemetryKey2,
+  turnExecutionTelemetryKey as turnExecutionTelemetryKey3,
   withTraceContext,
   withMcpTelemetry
 } from "@opengeni/observability";
@@ -3670,6 +3670,7 @@ import { fetchXaiSubscriptionQuota } from "@opengeni/xai-subscription";
 import { environmentsEncryptionKeyBytes } from "@opengeni/config";
 
 // src/activities/agent-turn/finalization-monitor.ts
+import { turnExecutionTelemetryKey } from "@opengeni/observability";
 var TURN_FINALIZATION_STAGES = [
   "tool_writers",
   "credential_renewals",
@@ -3701,6 +3702,16 @@ function diagnose(operation) {
 }
 function startTurnFinalizationMonitor(input) {
   const { observability, details } = input;
+  const correlation = {};
+  diagnose(() => {
+    if (input.execution) {
+      correlation.correlationId = turnExecutionTelemetryKey(
+        input.execution.workspaceId,
+        input.execution.sessionId,
+        input.execution.attemptId
+      );
+    }
+  });
   if (!initialized.has(observability)) {
     for (const stage2 of TURN_FINALIZATION_STAGES) {
       diagnose(() => observability.incrementGauge({ ...INFLIGHT, labels: { stage: stage2 }, amount: 0 }));
@@ -3743,7 +3754,8 @@ function startTurnFinalizationMonitor(input) {
             observability.error("turn finalization stalled; containing worker", {
               surface: "turn_finalization",
               outcome: "containment",
-              reason: next
+              reason: next,
+              ...correlation
             });
           } catch {
           }
@@ -3756,7 +3768,8 @@ function startTurnFinalizationMonitor(input) {
           observability.warn("turn finalization is taking longer than expected", {
             surface: "turn_finalization",
             outcome: "slow",
-            reason: next
+            reason: next,
+            ...correlation
           });
         }),
         input.slowAfterMs ?? 3e4
@@ -4618,7 +4631,12 @@ async function finalizeTurnAttempt(deps) {
       } catch {
       }
     },
-    requestWorkerDrain: deps.requestWorkerDrain
+    requestWorkerDrain: deps.requestWorkerDrain,
+    execution: {
+      workspaceId: deps.input.workspaceId,
+      sessionId: deps.input.sessionId,
+      attemptId: deps.input.attemptId
+    }
   });
   try {
     monitor.enter("tool_writers");
@@ -5259,7 +5277,7 @@ import {
 } from "@opengeni/codex";
 
 // src/activities/agent-turn/admission.ts
-import { checkWorkspaceAllowance, getBillingBalance, sumUsageQuantity } from "@opengeni/db";
+import { checkWorkspaceAllowance, getSpendableCreditBalance, sumUsageQuantity } from "@opengeni/db";
 import {
   configuredStaticUsageLimits
 } from "@opengeni/config";
@@ -5268,6 +5286,7 @@ import { directPersonalConnectionSubjectId } from "@opengeni/core";
 import { createHash as createHash7 } from "crypto";
 
 // src/activities/agent-turn/model-usage.ts
+import { canonicalizeConfiguredModelId } from "@opengeni/config";
 import {
   applyCreditDebitUpToBalance,
   recordUsageEvent,
@@ -5297,6 +5316,12 @@ function modelUsageSourceKey(input) {
   }
   return input.dispatchId ? `${input.dispatchId}:${input.positionalKey}` : input.positionalKey;
 }
+function aggregateCreditPolicyRevision(input) {
+  if (input.chargesOpenGeniCredits && input.responseRevisions.size > 1 && (input.totalTokens ?? 0) > 0) {
+    throw new Error("Aggregate model usage spans different credit policy revisions");
+  }
+  return input.responseRevisions.size === 1 ? input.responseRevisions.values().next().value : input.lastAdmittedRevision;
+}
 async function recordCompletedModelCallBeforeOwnershipFences(input) {
   await input.renewLease();
   await input.recordUsage();
@@ -5346,6 +5371,9 @@ async function processModelResponseTerminalEvent(input) {
   if (!terminal) {
     return { status: "not_response" };
   }
+  if (!terminal.usage && input.event.type === "raw_model_stream_event" && input.event.data.type !== "response_done") {
+    return { status: "not_response" };
+  }
   const responseOrdinal = input.state.responseCount + 1;
   const sourceKey = modelUsageSourceKey({
     responseId: terminal.responseId,
@@ -5378,6 +5406,7 @@ async function processModelResponseTerminalEvent(input) {
         turnId: input.turnId,
         turnAttemptId: input.turnAttemptId,
         model: input.model,
+        creditPolicyRevision: input.creditPolicyRevision,
         externallyBilled: input.externallyBilled,
         ...input.chargesOpenGeniCredits !== void 0 ? { chargesOpenGeniCredits: input.chargesOpenGeniCredits } : {},
         ...input.countsTowardTokenCap !== void 0 ? { countsTowardTokenCap: input.countsTowardTokenCap } : {},
@@ -5478,6 +5507,7 @@ async function processCompactionModelUsageEvent(input) {
         turnId: input.turnId,
         turnAttemptId: input.turnAttemptId,
         model: input.model,
+        creditPolicyRevision: input.creditPolicyRevision,
         externallyBilled: input.externallyBilled,
         ...input.chargesOpenGeniCredits !== void 0 ? { chargesOpenGeniCredits: input.chargesOpenGeniCredits } : {},
         ...input.countsTowardTokenCap !== void 0 ? { countsTowardTokenCap: input.countsTowardTokenCap } : {},
@@ -5745,6 +5775,8 @@ async function recordModelUsageAndDebitCredits(settings, db, input) {
       workspaceId: input.workspaceId,
       type: "model_usage_debit",
       requestedAmountMicros: costMicros,
+      modelId: canonicalizeConfiguredModelId(settings, input.model),
+      creditPolicyRevision: input.creditPolicyRevision,
       sourceType: "model_response",
       sourceId: `${input.turnId}:${input.sourceKey}`,
       idempotencyKey: `credit:model_usage_debit:${input.turnId}:${input.sourceKey}`,
@@ -5946,7 +5978,7 @@ var AllowanceExhaustedError = class extends Error {
 };
 async function ensureRunAllowedBetweenModelCalls(input) {
   try {
-    await ensureRunAllowed(
+    return await ensureRunAllowed(
       input.settings,
       input.db,
       input.accountId,
@@ -5955,7 +5987,8 @@ async function ensureRunAllowedBetweenModelCalls(input) {
       input.entitlements,
       input.chargesOpenGeniCredits,
       input.countsTowardTokenCap,
-      input.initiatingHumanSubjectId
+      input.initiatingHumanSubjectId,
+      input.modelId
     );
   } catch (limitError) {
     let serializedRunState = null;
@@ -5970,7 +6003,8 @@ async function ensureRunAllowedBetweenModelCalls(input) {
     );
   }
 }
-async function ensureRunAllowed(settings, db, accountId, workspaceId, isExternallyBilledTurn, entitlements, chargesOpenGeniCredits = !isExternallyBilledTurn, countsTowardTokenCap = !isExternallyBilledTurn, initiatingHumanSubjectId = null) {
+async function ensureRunAllowed(settings, db, accountId, workspaceId, isExternallyBilledTurn, entitlements, chargesOpenGeniCredits = !isExternallyBilledTurn, countsTowardTokenCap = !isExternallyBilledTurn, initiatingHumanSubjectId = null, modelId) {
+  let creditPolicyRevision;
   if (chargesOpenGeniCredits && entitlements && (settings.billingMode === "stripe" || settings.usageLimitsMode === "managed")) {
     const decision = await entitlements.admitRun({
       accountId,
@@ -5982,7 +6016,8 @@ async function ensureRunAllowed(settings, db, accountId, workspaceId, isExternal
       throw new Error(decision.reason || "insufficient Opengeni credits");
     }
   } else if (chargesOpenGeniCredits && (settings.billingMode === "stripe" || settings.usageLimitsMode === "managed")) {
-    const balance = await getBillingBalance(db, accountId);
+    const balance = await getSpendableCreditBalance(db, accountId, modelId);
+    creditPolicyRevision = balance.creditPolicyRevision;
     if (balance.balanceMicros <= 0) {
       throw new Error("insufficient Opengeni credits");
     }
@@ -6020,6 +6055,48 @@ async function ensureRunAllowed(settings, db, accountId, workspaceId, isExternal
       }
     }
   }
+  return creditPolicyRevision;
+}
+
+// src/activities/agent-turn/provider-recovery-metrics.ts
+function providerRecoveryCause(code) {
+  if (code === "provider_rate_limited") return "rate_limited";
+  if (code === "provider_unavailable") return "unavailable";
+  if (code === "upstream_connectivity_unavailable") return "connectivity";
+  return null;
+}
+function readProviderRecoveryObservation(metadata) {
+  const cause = providerRecoveryCause(metadata.providerRecoveryReason);
+  const startedAt = typeof metadata.providerRecoveryStartedAt === "string" ? Date.parse(metadata.providerRecoveryStartedAt) : Number.NaN;
+  return cause && Number.isFinite(startedAt) ? { cause, startedAt } : void 0;
+}
+function recordProviderRecoveryOutcome(observability, input) {
+  if (!input.route) return;
+  const labels = { ...input.route, cause: input.cause, outcome: input.outcome };
+  try {
+    observability.incrementCounter({
+      name: "opengeni_model_recovery_total",
+      help: "Observed model recovery decisions and successful resumptions.",
+      labels
+    });
+    if (input.delayMs !== void 0) {
+      observability.observeHistogram({
+        name: "opengeni_model_recovery_delay_seconds",
+        help: "Scheduled model recovery delay, including provider hints and jitter.",
+        labels: { ...input.route, cause: input.cause },
+        value: Math.max(0, input.delayMs) / 1e3
+      });
+    }
+    if (input.elapsedMs !== void 0) {
+      observability.observeHistogram({
+        name: "opengeni_model_recovery_duration_seconds",
+        help: "Elapsed recovery episode including backoff, preparation and model requests.",
+        labels,
+        value: Math.max(0, input.elapsedMs) / 1e3
+      });
+    }
+  } catch {
+  }
 }
 
 // src/activities/agent-turn/failure-settlement.ts
@@ -6091,9 +6168,13 @@ async function settleTurnFailure(deps) {
   try {
     return await settleTurnFailureInAttempt(deps);
   } catch (error51) {
+    if (deps.control.activityStatus === "recovering" && error51 instanceof ApplicationFailure && error51.type === "OpenGeniPostClaimDatabaseRecovery")
+      throw error51;
     if (deps.attempt.turnId && deps.attempt.triggerEventId) {
       const recovery = postClaimDatabaseRecoveryFailure({
-        error: error51,
+        // A failed rollback/terminal write must not erase no-replay evidence
+        // from the failure we were settling (notably unknown tool effects).
+        error: new AggregateError([error51, deps.error], "Turn failure settlement failed"),
         turnId: deps.attempt.turnId,
         triggerEventId: deps.attempt.triggerEventId,
         executionGeneration: deps.attempt.executionGeneration,
@@ -7395,7 +7476,8 @@ async function settleTurnFailureInAttempt(deps) {
     const recoveryResult = providerRecoveryResult({
       failureCode: failure2.code,
       attemptNumber: nextProviderRecoveryCount,
-      retryAfterMs: providerRetryAfterMs(error51)
+      retryAfterMs: providerRetryAfterMs(error51),
+      jitterSample: Math.random()
     });
     const setupRecoveryExhausted = earlyCommandStartUnavailable && recoveryResult.status === "exhausted" && attempt.providerRecoveryCount === SANDBOX_SETUP_RECOVERY_LIMIT;
     try {
@@ -7459,9 +7541,27 @@ async function settleTurnFailureInAttempt(deps) {
         control.turnMetricOutcome = "recovering";
         control.activityStatus = "recovering";
         control.activityError = error51;
+        const recoveryCause2 = providerRecoveryCause(failure2.code);
+        if (recoveryCause2) {
+          recordProviderRecoveryOutcome(observability, {
+            route: attempt.modelMetricRoute,
+            cause: recoveryCause2,
+            outcome: "scheduled",
+            delayMs: recoveryResult.continueDelayMs
+          });
+        }
         return claimedResult(recoveryResult);
       }
       failure2 = providerRecoveryExhaustedFailure(failure2, recoveryResult);
+      const recoveryCause = providerRecoveryCause(failure2.code);
+      if (recoveryCause) {
+        recordProviderRecoveryOutcome(observability, {
+          route: attempt.modelMetricRoute,
+          cause: recoveryCause,
+          outcome: "exhausted",
+          ...attempt.providerRecoveryObservation ? { elapsedMs: Date.now() - attempt.providerRecoveryObservation.startedAt } : {}
+        });
+      }
       if (earlyRecoverableSetup) {
         control.activityStatus = "failed";
         control.turnMetricOutcome = "failed";
@@ -8835,6 +8935,8 @@ async function runTurnStreamAttempt(deps) {
   );
   let parallelSessionTitle = null;
   let parallelSessionTitleFinished = false;
+  let creditPolicyRevision;
+  let titleCreditPolicyRevision;
   const finishParallelSessionTitle = async () => {
     if (parallelSessionTitleFinished) return;
     parallelSessionTitleFinished = true;
@@ -8843,6 +8945,7 @@ async function runTurnStreamAttempt(deps) {
     if (generated.usage) {
       await processSessionTitleModelUsageEvent({
         usage: generated.usage,
+        creditPolicyRevision: titleCreditPolicyRevision,
         state: sessionTitleUsageState,
         dispatchId: modelUsageDispatchId,
         settings,
@@ -9009,7 +9112,8 @@ async function runTurnStreamAttempt(deps) {
   let finalReplyNudged = false;
   const revalidateModelCallAdmission = async () => {
     await historySink.reconcileConversationTruth({ requireDurable: true });
-    await ensureRunAllowedBetweenModelCalls({
+    creditPolicyRevision = await ensureRunAllowedBetweenModelCalls({
+      modelId: resolvedModel?.configured.id ?? turn.model,
       settings,
       db,
       accountId: input.accountId,
@@ -9031,6 +9135,7 @@ async function runTurnStreamAttempt(deps) {
       signal: runtimeCancellationSignal,
       admit: revalidateModelCallAdmission
     });
+    const responseCreditPolicyRevisions = /* @__PURE__ */ new Set();
     const responseCountBeforeStream = modelResponseState.responseCount;
     eventing.batcher = null;
     let currentToolBatchCallIds = /* @__PURE__ */ new Set();
@@ -9200,7 +9305,10 @@ async function runTurnStreamAttempt(deps) {
         attempt.modelRequestStarted = true;
         return await runtime.runStream(agent, runInput, eventing.modelRunSettings, {
           beforeModelRequest: modelCallAdmission.beforeModelRequest,
-          onModelResponse: modelCallAdmission.onModelResponse,
+          onModelResponse: (event) => {
+            responseCreditPolicyRevisions.add(creditPolicyRevision);
+            return modelCallAdmission.onModelResponse(event);
+          },
           signal: runtimeCancellationSignal,
           sandboxEnvironment,
           onModelVisibleContext: async (snapshot) => {
@@ -9390,6 +9498,7 @@ async function runTurnStreamAttempt(deps) {
         }
         const generatedImageReceipt = generatedImage ? await media.retainNativeGeneratedImage(generatedImage) : null;
         const responseResult = await processModelResponseTerminalEvent({
+          creditPolicyRevision,
           event: next.value,
           state: modelResponseState,
           dispatchId: modelUsageDispatchId,
@@ -9452,6 +9561,15 @@ async function runTurnStreamAttempt(deps) {
             ]);
             attempt.providerRecoveryCount = 0;
           }
+          if (attempt.providerRecoveryObservation) {
+            recordProviderRecoveryOutcome(observability, {
+              route: attempt.modelMetricRoute,
+              cause: attempt.providerRecoveryObservation.cause,
+              outcome: "recovered",
+              elapsedMs: Date.now() - attempt.providerRecoveryObservation.startedAt
+            });
+            attempt.providerRecoveryObservation = void 0;
+          }
           const rawStreamHistory = eventing.stream.state.history;
           if (Array.isArray(rawStreamHistory)) {
             await media.retainNativeGeneratedImagesFromHistory(
@@ -9464,18 +9582,6 @@ async function runTurnStreamAttempt(deps) {
           await historySink.reconcileConversationTruth();
           turnLifecycleMetricsFor(observability).progress({ attemptId: input.attemptId });
           modelCheckpointMemoryCollector.schedule(observability);
-          await ensureRunAllowedBetweenModelCalls({
-            settings,
-            db,
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            isExternallyBilledTurn: billingState.isExternallyBilledTurn,
-            entitlements,
-            chargesOpenGeniCredits: billingState.chargesOpenGeniCredits,
-            countsTowardTokenCap: billingState.countsTowardTokenCap,
-            initiatingHumanSubjectId: turn.initiatingHumanSubjectId,
-            serializedRunState: () => media.compactMediaRunState(String(eventing.stream.state.toString()))
-          });
         }
         modelCallAdmission.settle(next.value);
         const durableSdkEvent = generatedImageReceipt ? compactGeneratedImageSdkEvent(next.value, generatedImageReceipt) : next.value;
@@ -9769,6 +9875,12 @@ async function runTurnStreamAttempt(deps) {
     if (!streamSawPerResponseUsage) {
       const aggregateUsage = eventing.stream.state.usage;
       const normalizedAggregateUsage = normalizeModelCallUsage2(aggregateUsage);
+      const aggregatePolicyRevision = aggregateCreditPolicyRevision({
+        responseRevisions: responseCreditPolicyRevisions,
+        lastAdmittedRevision: creditPolicyRevision,
+        chargesOpenGeniCredits: billingState.chargesOpenGeniCredits,
+        totalTokens: normalizedAggregateUsage.totalTokens
+      });
       const aggregateInput = normalizedAggregateUsage.telemetry.inputTokens;
       const aggregateSourceKey = modelUsageSourceKey({
         responseId: null,
@@ -9789,6 +9901,7 @@ async function runTurnStreamAttempt(deps) {
           leaseLostMessage: "Provider credential lease expired during the active turn",
           recordUsage: async () => {
             const billing = await recordModelUsageAndDebitCredits(settings, db, {
+              creditPolicyRevision: aggregatePolicyRevision,
               accountId: input.accountId,
               workspaceId: input.workspaceId,
               sessionId: input.sessionId,
@@ -10125,6 +10238,7 @@ async function runTurnStreamAttempt(deps) {
       turnExecutionPolicy.providerId,
       turnExecutionPolicy.latencyMode
     );
+    titleCreditPolicyRevision = creditPolicyRevision;
     parallelSessionTitle = startParallelSessionTitleGeneration({
       signal: runtimeCancellationSignal,
       generate: async (signal) => await withSessionTitleProviderRequestContext(
@@ -10330,7 +10444,7 @@ import {
   requireSession
 } from "@opengeni/db";
 import { appendAndPublishTurnEventsFenced as appendAndPublishTurnEventsFenced2, publishDurableSessionEvents as publishDurableSessionEvents4 } from "@opengeni/events";
-import { linkCurrentSpanToAdmission, turnExecutionTelemetryKey } from "@opengeni/observability";
+import { linkCurrentSpanToAdmission, turnExecutionTelemetryKey as turnExecutionTelemetryKey2 } from "@opengeni/observability";
 import {
   assertTurnExecutionPolicyMatchesConfigV1,
   settingsForAcceptedSubscriptionTurn,
@@ -10684,6 +10798,7 @@ async function claimTurnAttempt(deps) {
   attempt.dispatchId = dispatchId;
   attempt.executionGeneration = turn.executionGeneration;
   attempt.providerRecoveryCount = providerRecoveryCountFromMetadata(turn.metadata);
+  attempt.providerRecoveryObservation = readProviderRecoveryObservation(turn.metadata ?? {});
   const authRecovery = turn.metadata?.claudeAuthRecovery;
   attempt.claudeAuthRecovery = authRecovery && typeof authRecovery === "object" && "credentialId" in authRecovery && typeof authRecovery.credentialId === "string" && "credentialVersion" in authRecovery && typeof authRecovery.credentialVersion === "number" && Number.isSafeInteger(authRecovery.credentialVersion) && authRecovery.credentialVersion > 0 ? {
     credentialId: authRecovery.credentialId,
@@ -10793,6 +10908,7 @@ async function claimTurnAttempt(deps) {
       latencyMode: turn.latencyMode
     }
   );
+  capabilitySettings = { ...capabilitySettings, openaiMaxRetries: 0 };
   runtime.configure(capabilitySettings);
   const verifiedExecutionPolicy = assertTurnExecutionPolicyMatchesConfigV1(
     capabilitySettings,
@@ -10804,6 +10920,10 @@ async function claimTurnAttempt(deps) {
     }
   );
   const turnExecutionPolicy = verifiedExecutionPolicy.policy;
+  attempt.modelMetricRoute = {
+    provider: turnExecutionPolicy.providerId,
+    model: turnExecutionPolicy.productModelId
+  };
   assertSessionAllowsProductModel(session, turnExecutionPolicy.productModelId);
   const billingIdentity = turnExecutionPolicyBillingIdentity(turnExecutionPolicy);
   billingState.isExternallyBilledTurn = billingIdentity.externallyBilled;
@@ -10857,7 +10977,8 @@ async function claimTurnAttempt(deps) {
         entitlements,
         billingState.chargesOpenGeniCredits,
         billingState.countsTowardTokenCap,
-        turn.initiatingHumanSubjectId
+        turn.initiatingHumanSubjectId,
+        turnExecutionPolicy.productModelId
       ),
       cancellationSignal,
       void 0
@@ -11007,7 +11128,7 @@ async function claimTurnAttempt(deps) {
   throwIfTurnCancelled();
   recordTurnStartupPhase(observability, {
     phase: "claim_and_policy",
-    executionCorrelationId: turnExecutionTelemetryKey(
+    executionCorrelationId: turnExecutionTelemetryKey2(
       input.workspaceId,
       input.sessionId,
       input.attemptId
@@ -12745,9 +12866,11 @@ async function prepareCompaction(deps) {
   };
   const promptCacheKey = acceptsPromptCacheKeyForTurn(resolvedModel) ? input.sessionId : void 0;
   const compactionUsageState = createCompactionModelUsageEventState(claimedModelUsageSourceKeys);
+  let compactionCreditPolicyRevision;
   const recordCompactionUsage = async (usage) => {
     await processCompactionModelUsageEvent({
       usage,
+      creditPolicyRevision: compactionCreditPolicyRevision,
       state: compactionUsageState,
       dispatchId: modelUsageDispatchId,
       settings,
@@ -12775,7 +12898,7 @@ async function prepareCompaction(deps) {
     });
   };
   const compactionSummarizerFor = (systemInstructions) => {
-    const summarize = resolvedModel ? (s, m) => withProviderRequestContext(
+    const summarizeModel = resolvedModel ? (s, m) => withProviderRequestContext(
       () => summarizeContextForCompaction(s, m, {
         client: resolvedModel.client,
         provider: resolvedModel.provider,
@@ -12796,6 +12919,21 @@ async function prepareCompaction(deps) {
       ...systemInstructions ? { systemInstructions } : {},
       ...promptCacheKey ? { promptCacheKey } : {}
     });
+    const summarize = async (s, m) => {
+      compactionCreditPolicyRevision = await ensureRunAllowedBetweenModelCalls({
+        settings: s,
+        db,
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        modelId: resolvedModel?.configured.id ?? turn.model,
+        isExternallyBilledTurn: billingState.isExternallyBilledTurn,
+        chargesOpenGeniCredits: billingState.chargesOpenGeniCredits,
+        countsTowardTokenCap: billingState.countsTowardTokenCap,
+        initiatingHumanSubjectId: turn.initiatingHumanSubjectId,
+        entitlements: deps.entitlements
+      });
+      return await summarizeModel(s, m);
+    };
     summarize.estimatePrefixTokens = () => {
       if (resolvedModel?.provider.api === "chat") {
         return estimateSerializedValueTokens(systemInstructions ?? "");
@@ -12822,6 +12960,18 @@ async function prepareCompaction(deps) {
     await publishDurableSessionEvents6(bus, input.workspaceId, input.sessionId, events);
   };
   const publishCompactionOutcomeEvents = async (events) => {
+    if (events.some((event) => event.type === "session.context.compacted")) {
+      attempt.providerRecoveryCount = 0;
+      if (attempt.providerRecoveryObservation) {
+        recordProviderRecoveryOutcome(observability, {
+          route: attempt.modelMetricRoute,
+          cause: attempt.providerRecoveryObservation.cause,
+          outcome: "recovered",
+          elapsedMs: Date.now() - attempt.providerRecoveryObservation.startedAt
+        });
+        attempt.providerRecoveryObservation = void 0;
+      }
+    }
     await publishDurableSessionEvents6(
       bus,
       input.workspaceId,
@@ -33172,6 +33322,7 @@ import {
 import { SandboxChannelAService as SandboxChannelAService3 } from "@opengeni/runtime/sandbox";
 import { sandboxRunAs as sandboxRunAs4 } from "@opengeni/runtime";
 import {
+  bundledSkillSelectionForAgentConfig,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS as DEFAULT_FIRST_PARTY_MCP_PERMISSIONS2,
   resolveAgentToolFamilies
 } from "@opengeni/contracts";
@@ -34928,7 +35079,9 @@ async function prepareTurnToolRuntime(deps) {
     session.firstPartyMcpPermissions,
     linkedAuthority
   );
-  const toolFamilies = resolveAgentToolFamilies(session.agent);
+  const toolFamilies = resolveAgentToolFamilies(session.agent, {
+    sandboxAttached: (activeSandboxBackend ?? groupBoxBackend) !== "none"
+  });
   const selectedFirstPartyMcpTools = toolFamilies.firstPartyTools(
     allowedFirstPartyMcpToolsForSession(runSettings, session.firstPartyMcpTools)
   );
@@ -34988,7 +35141,9 @@ async function prepareTurnToolRuntime(deps) {
     })
   ]);
   const bundledSkills = loadConfiguredBundledSkills({
-    bundledSkillIds: session.bundledSkillIds,
+    // Rows that could not freeze the "none" default at create (scheduled
+    // generated sessions, pre-existing rows) get the same rule here.
+    bundledSkillIds: bundledSkillSelectionForAgentConfig(session.bundledSkillIds, session.agent),
     firstPartyTools: selectedFirstPartyMcpTools,
     videoGenerationEnabled: skillConfiguration.defaultModelId !== null && skillConfiguration.enabledModelIds.length > 0
   });
@@ -38394,6 +38549,7 @@ function createRunAgentTurnActivity(services) {
             )
           );
           const compactionPrep = await prepareCompaction({
+            entitlements,
             input,
             settings: capabilitySettings,
             db,
@@ -39205,7 +39361,7 @@ These are publication receipts for the human's earlier answer. Do not call the r
     const servicesStartedAt = performance.now();
     const resolvedServices = await services();
     const servicesDurationSeconds = (performance.now() - servicesStartedAt) / 1e3;
-    const correlationId = turnExecutionTelemetryKey2(
+    const correlationId = turnExecutionTelemetryKey3(
       input.workspaceId,
       input.sessionId,
       input.attemptId
@@ -40351,4 +40507,4 @@ export {
   createTurnActivities,
   createTurnActivitiesFromServices
 };
-//# sourceMappingURL=activities-turn-5LGZOSVU.js.map
+//# sourceMappingURL=activities-turn-BMY3CDKL.js.map